Effective date: July 20, 2026
1. Who we are
This site is operated by CFORick ("we", "us", "our"). If you have a question about this Privacy Policy or your personal data, contact us at info@cforick.com. Our mailing address is: 1428 Shotwell Street San Francisco, CA 94110.
2. What this policy covers
This Privacy Policy explains what information we collect when you visit this website or submit information through our forms (which are powered by Hostmap), how we use that information, who we share it with, how long we keep it, and the rights you have over it. It applies to visitors, prospects, and anyone who contacts us through the site.
3. Information we collect
3.1 Information you give us in forms
When you submit a contact, quote, or lead form on the site, we collect the fields you fill in — typically your name, email address, phone number, company, and any message or details you provide. These fields are optional unless the form marks them as required; if you don't fill in a required field, we can't respond to your enquiry.
3.2 Technical information collected with every form submission
To protect the form and the people who use it from spam, fraud, and abuse, our form system captures the following technical details every time a form is submitted:
- Your IP address
- Your browser and operating system (from the User-Agent header)
- The page you were on when you submitted the form (the referrer URL)
- A timestamp of the submission
- Anti-bot signals (e.g. how long you spent on the form, whether required hidden fields were filled by an automated script)
We use this information strictly to identify and block bad actors — automated spam submitters, credential-testing bots, and fraudulent enquiries. It is not used to profile or track individual visitors, and it is not shared with advertising platforms.
3.3 Information collected automatically as you browse
When you visit the site, our web server and hosting provider automatically receive standard log information (IP address, browser type, requested URL, timestamp, response code). This is standard for any website on the internet and is used for security monitoring and performance troubleshooting.
3.4 Cookies and similar technologies
We use cookies and comparable browser storage for four purposes:
- Essential: Required for the site to function — for example, remembering your cookie-consent choice, keeping you signed in if you have an account, and protecting against cross-site request forgery. These cannot be turned off.
- Analytics: Google Analytics 4 (GA4). GA4 records aggregate visitor behaviour (which pages are popular, referral sources, device categories) so we can improve the site. IP addresses are anonymised.
- Advertising: Pixels from Meta (Facebook / Instagram), Google Ads, Reddit, and LinkedIn. These allow those platforms to measure how well our ads performed (e.g. how many people clicked an ad and then submitted a form) and to show you our ads on their platforms if you already saw us elsewhere. See section 5 for the full third-party list.
- Functional: Reserved for optional enhancements like embedded videos or third-party widgets that require a cookie to work. Off by default.
None of the analytics or advertising cookies are set until you give consent through our cookie banner. You can change your choice at any time by clicking the cookie icon at the bottom-left of any page.
4. Why we use your information (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry submitted through a form | Legitimate interest (Art. 6(1)(f)) — you asked us to contact you; and pre-contractual steps (Art. 6(1)(b)) where you are enquiring about our services. |
| Detecting and blocking spam / fraudulent form submissions | Legitimate interest (Art. 6(1)(f)) — protecting our systems and the people who use them from abuse. |
| Analytics (GA4) | Consent (Art. 6(1)(a)) — you accepted the "Analytics" category in the cookie banner. |
| Advertising pixels (Meta, Google Ads, Reddit, LinkedIn) | Consent (Art. 6(1)(a)) — you accepted the "Advertising" category in the cookie banner. |
| Security logging and hosting-level telemetry | Legitimate interest (Art. 6(1)(f)) — keeping the service available and safe. |
5. Third parties that process data on our behalf
We share the minimum information necessary with the following categories of processors. None of them are permitted to use your data for their own purposes, and none of them buy your data from us — we do not sell personal information.
- Web hosting: Our hosting provider processes web-server logs (IP, request path, timestamp) as an ordinary part of serving the site.
- Hostmap forms: Our form processor. Receives the fields you submit plus the anti-abuse signals in section 3.2. Only your requested contact information is retained; anti-abuse signals are purged on our standard retention schedule.
- Google — Analytics (GA4): Only when you consent to Analytics. Processes anonymised page-view and behaviour data. policies.google.com/privacy
- Google — Ads: Only when you consent to Advertising. Used for ad measurement and remarketing. policies.google.com/technologies/ads
- Meta (Facebook, Instagram): Only when you consent to Advertising. The Meta Pixel measures ad performance and enables remarketing on Meta platforms. facebook.com/privacy/policy
- Reddit: Only when you consent to Advertising. Measures ad performance for our Reddit campaigns. reddit.com/policies/privacy-policy
- LinkedIn: Only when you consent to Advertising. The LinkedIn Insight Tag measures ad performance and enables remarketing on LinkedIn. linkedin.com/legal/privacy-policy
We do not sell personal data to any third party.
6. International transfers
Some of the third-party processors listed above (notably Google, Meta, Reddit, and LinkedIn) are established in the United States. When your data is transferred outside the EEA/UK, we rely on the transfer mechanisms those providers make available — most commonly the Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU–US Data Privacy Framework — to provide an equivalent level of protection.
7. How long we keep information
- Contact-form submissions are retained for as long as we reasonably need to respond to your enquiry and follow up (typically up to 24 months), then archived or deleted.
- Anti-abuse technical signals (IPs, User-Agent, timestamps from section 3.2) are retained for up to 90 days and then deleted or aggregated.
- Web-server access logs are retained for up to 30 days.
- Analytics data in GA4 is retained on Google's minimum available retention setting (currently 2 months for user-level data).
- Advertising-pixel data is retained by those platforms according to their own retention policies (linked in section 5).
8. Your rights
If you are in the UK, EEA, or another jurisdiction with equivalent data-protection law, you have the following rights over your personal data:
- Access: Ask for a copy of the information we hold about you.
- Rectification: Ask us to correct information that is wrong or out of date.
- Erasure: Ask us to delete your personal data (the "right to be forgotten").
- Restriction: Ask us to pause certain uses of your data while a dispute is resolved.
- Objection: Object to processing that is based on our legitimate interests.
- Portability: Ask for a machine-readable copy of data you gave us so you can move it elsewhere.
- Withdraw consent: Where processing is based on consent (analytics, advertising), withdraw it at any time using the cookie preferences widget. Withdrawing consent does not affect processing that already happened.
- Complain: Lodge a complaint with your local data-protection authority. In the UK this is the ICO (ico.org.uk); in the EU this is your national supervisory authority.
To exercise any of these rights, use our Data Access & Erasure Request form or email info@cforick.com. We’ll respond within one month.
9. Children
This site is not directed at children under 16, and we do not knowingly collect information from children. If you believe a child has submitted information to us, please contact us and we will delete it.
10. Security
We use HTTPS everywhere, keep our software up to date, and restrict access to form submissions on a need-to-know basis. No system is 100% secure — if we become aware of a breach affecting your personal data, we will notify affected people and the relevant regulator without undue delay, as required by law.
11. Changes to this policy
If we make material changes to how we process personal data, we will update this page and, where the change is significant, prompt returning visitors to review the updated policy. The "Effective date" at the top of this page tells you when the current version took effect.
12. Contact
Questions about this policy or your data: info@cforick.com.